Tuesday, May 6, 2014

VPN and Amazon AWS

Recently I have worked on few VPN projects where my customers
requested VPN connections to their Amazon VPCs (Virtual Private Cloud).
As you probably know, today’s companies are very complex and in the same
building there can be many organizations, contractors, etc. In my
project I had to set up VPN tunnels for three different organizations
located behind the same VPN concentrator. One of them had their VPC in
US, the second one in Europe. The project was completed without any
issues. The problems appeared when third organization, located behind
the same VPN concentrator. They requested a new tunnel to their VPC located
in Europe.
Let’s sum up all requirements:

When I installed ASA I configured one outside interface with one
public IP. Then when I started to work on first two VPNs I received two files (one per each customer) with
configuration generated by VPCs. The config files contained all
settings together with peers IPs (public). As I mentioned before the
both tunnels were set up with no issues. When I asked for the third
tunnel settings (Customer “C” -> VPC-C) I found the peer IP was the
same as for the customer “B” tunnel. It meant Amazon didn’t allocate
the public IP for each my customers VPCs. Amazon has only one public IP
per region and in my case I couldn’t set up the tunnel for the customer
“C” with the current configuration. The easiest way is to have only
one tunnel for VPC-B and VPC-C but from security reasons the customer
“B” can’t have access to “VPC-C” and vice versa. One of the proposed
solutions was a new design of ASA and implementation of sub-interfaces
on the outside interface with more public IPs. Of course for such
solution you need to have more public IPs what can be expensive depends
on the number of IP addresses. The second option is using a BGP
protocol, accepted by Amazon, but the ASA doesn’t support it.

If you planning to work with Amazon products like VPC , take into
account this one huge limitation because if your environment requires
99.999% availability, every big change in your design can be painful.